Authentication

ServOS uses AuthOS for all human authentication. It does not accept local passwords, issue local user sessions, enroll MFA, or provide password recovery. Those account-security workflows remain in AuthOS.

Required configuration

AUTHOS_URL=https://athapi.authos.dev
AUTHOS_ORG_SLUG=queuezero
AUTHOS_SERVICE_SLUG=servos
AUTHOS_AUDIENCE=service:queuezero/servos
[email protected]
SERVOS_WEB_URL=https://admin.servos.dev

Register this exact redirect URI on the AuthOS service:

https://admin.servos.dev/auth/callback

The browser opens AuthOS’s hosted sign-in page, where the providers configured for the organization or platform—such as Google and GitHub—are available. AuthOS returns an access token to the registered callback. ServOS validates its signature, issuer, and service:queuezero/servos audience against AuthOS JWKS.

SERVOS_SUPER_ADMIN_EMAILS is an explicit, case-insensitive allowlist. A valid AuthOS token for a listed email receives ServOS owner permissions. It does not bypass AuthOS authentication and should be kept intentionally small.

Existing historical local_users rows may remain in an upgraded database for rollback and migration auditability, but ServOS does not consult them for login or authorization and exposes no local-account endpoints.